[NEWS] IBM Lotus Domino iNotes Multiple XSS Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



IBM Lotus Domino iNotes Multiple XSS Vulnerabilities
------------------------------------------------------------------------


SUMMARY

"
<http://www-142.ibm.com/software/sw-lotus/products/product1.nsf/wdocs/webaccesshome> IBM Lotus Domino Web Access is the flexible, high-function Web browser-based client option to use the reliable, security-rich messaging and collaboration capabilities of IBM Lotus Domino server, online and offline".

There are multiple cross site scripting vulnerabilities on IBM Lotus
Domino iNotes, potentially allowing arbitrary Javascript execution.

DETAILS

Vulnerable Systems:
* IBM Lotus Domino Web Access 7.x
* IBM Lotus Domino Web Access (iNotes) 6.x
* IBM Lotus Domino 6.x
* IBM Lotus Domino 7.x

Immune Systems:
* IBM Lotus Domino Web Access 6.5.5
* IBM Lotus Domino Web Access 7.0.1

Attached files (e.g. ".html" files) are opened in the context of the site
if the user clicks on it. This can be exploited to execute arbitrary
JavaScript code in the context of the user's session.

The email subject is not properly sanitized before being displayed to the
user as the browser title. This can be exploited to execute arbitrary
JavaScript in the context of the user's session when the user views a
received email.

Example:
< / TITLE>< SCRIPT>alert("Vulnerable!");< / SCRIPT>

It is possible to bypass certain security checks related to "javascript:"
URLs by inserting "&#13;" in the middle of the URL.
This can be exploited to execute arbitrary JavaScript code in the context
of the user's session.

Example:
< a href="java&#13;script:alert('Vulnerable!');">Link< / a>

The attachment filename is not properly sanitized before being displayed
to the user. This can be exploited to execute arbitrary JavaScript in
context of the user's session when the user views a received email.

Successful exploitation requires that the Domino Web Access ActiveX
control is not installed on the browser.

Disclosure Timeline:
22/08/2005 - Initial vendor notification.
25/08/2005 - Initial vendor response.
10/02/2006 - Public disclosure.


ADDITIONAL INFORMATION

The information has been provided by <mailto:vuln@xxxxxxxxxxx> Secunia
Research.
The original article can be found at:
<http://secunia.com/secunia_research/2005-38/>
http://secunia.com/secunia_research/2005-38/



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages